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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 


review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Not at all appropriate 
Not really appropriate 
Quite appropriate 
Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


Although I acknowledge the intention of the age brackets as defined so far I would recommend to 
change the age brackets based on my previous work in regard of children’s online safety as follows: 


under 6 years 
6 to under 9 years 
9 to under 12 years 


12 years and older 
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At the German Centre for Child Protection on the Internet we have developed the Model of Intelligent 
Risk Management. There we defined age brackets as described above based on the following 
reasoning. The ultimate objective of Intelligent Risk Management is to counter the risks and dangers 
that can affect children and adolescents through the use of the Internet, with a joint approach based 
on shared responsibility and competencies. This approach must take into account both the differing 
levels of potential threats as well as the differing usages children make of the Internet. The social 
background and educational level here can influence the differing conditions and existing knowledge 
of children and adolescents in the various stages of childhood and youth. 


Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 


For the Model of Intelligent Risk Management four age groups were distinguished, with a different 
strategic protective goal for each. Current studies show a steady increase in Internet use by children 
in the age group of under 6 year olds, who have little or no reading skills. This — the youngest — age 
group in particular has barely been considered until now in child protection measures, as Internet use 
was in any case rare and only undertaken by a few children, usually to a limited extent. The second 
group is made up of children aged 6 to under 9 years, who already have experience using the Internet 
and elementary competencies dealing with digital media, but are still largely socialised in a family 
environment. The third age group is made up of children from the age of 9 to under 12 years. In this 
stage of childhood the individual’s scope of action expands. Their parents, siblings and other family 
members are joined by other people with whom they have relationships and trust, all influencing 
their media socialisation. The fourth age group consists of children aged 12 and over, whose 
behaviour when using the media is largely shaped by an increasing independence when making use 
of what the Internet has to offer, as well as a growing ability to manage risks on their own. 


The strategic protective goals defined for each age group by the Intelligent Risk Management model 
reflect this development throughout the stages of childhood and adolescence. The younger the child, 
the more any means of protection should exclude or avoid risks. As children grow older, child 
protection can gradually be limited to reducing (serious) risks, and focus on the child’s own ability to 
cope with risks. Therefore, given a child’s general development of skills for dealing with media and 
their potential risks, the protective goals for the four age groups do not have fixed boundaries but 
are, rather, fluidly interrelated. The three buttresses of child protection — the design and content of 
the service, technologies, and media literacy — give rise to differing protective concepts for each of 
the four age groups, with each buttress bearing a different burden. 


Risk exclusion is the strategic goal of protection for the youngest age group. For children aged under 
6 we must endeavour to exclude risks, because this is where the maximum amount of safety must be 
achieved. Children in this age group already act independently when using the media, and their 
abilities should be improved by giving them elementary media literacy, but they are not yet able to 
contribute reliably to achieving the goal of their protection. Therefore in this age group the reliability 
of the media literacy element can only be guaranteed by parents playing an active part and being 
digital literate themselves in providing support for their child’s online activity. 
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Risk avoidance is the strategic goal for children aged 6 and over. As they develop reading skills 
children begin to make increasingly independent use of the Internet. They outgrow special child 
content and safe surfing areas, while communicative and interactive services become increasingly 
important. However the potential risks from this cannot be either completely prevented or avoided, 
neither by the provider nor by technical means. Elementary media literacy must therefore be 
developed further so that children can protect themselves against risks. As they grow, children 
expand their social environment, build contacts outside the family and develop spaces for 
independent activity. This is also apparent in their behaviour when using digital media. Alongside 
safe and attractive services, there are editorial and technical tools which can be used to shape one’s 
own online experience. Consequently, from the age of about 9 there should be a general transition 
from risk avoidance to risk reduction. This involves a process of gradually shifting from protection 
provided by third parties to the child’s own abilities. Thus, from the age of about 12 the strategic goal 
is risk reduction. In adolescence, media literacy in the sense of an ability to manage one’s own risk 
becomes a key element in child protection; serious risks can be reduced by appropriate configuration 
of services or technological protective measures as accompanying buttresses. The question of 
whether and to what extent harm and injury might result from the potential risks is regarded as 
secondary in the development of the model for the time being. On the other hand, the distinction 
between high-risk incidents that might cause harm or injury and the scale of the risk in the sense of 
the probability that harm or injury actually occurs after such an incident is of great relevance in the 
application and implementation of the model. In real terms: not every risk actually results in harm or 
injury to the child concerned. 


The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


The UNCRC establishes that children are themselves “rights holders”. In other words children have 
certain inalienable rights which are not contingent upon any other factors. States must provide a 
framework for the protection and implementation of the rights guaranteed by the Convention and 
this creates obligations towards children which other parties must respect (see General Comment No. 
16, Art. 8, 2013). The overarching or guiding principle of the UNCRC is stated in Article 3: 


“In all actions concerning children, whether undertaken by public or private social welfare 
institutions, courts of law, administrative authorities or legislative bodies, the best interests of the 
child shall be a primary consideration.” 
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Digital Media usage intersects with children’s rights at several different points e.g. the right to 
freedom of expression (Art. 13), the right to freedom of association and to freedom of peaceful 
assembly (Art. 15), the right to education (Art. 28) the right to rest and leisure, to engage in play and 
recreational activities appropriate to the age of the child and to participate freely in cultural life and 
the arts (Art. 31), the right to protection from commercial exploitation (Art. 32), the right to 
protection from all forms of sexual exploitation and sexual abuse (Art. 34) and not least the right to 
non-discrimination (Art.2). 


According to Article 13 children must be able to seek, receive and impart information and ideas of all 
kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any 
other media of the child's choice. Although for practical purposes there was no internet available to 
children when the Convention was written there can be no doubt that nowadays the Internet is the 
medium of choice when it comes to children exercising their right to access information. The same 
applies to the right of freedom of association and to freedom of peaceful assembly (Art. 15). 


While Article 28 prompts state parties to make primary, secondary and higher education accessible 

to all it also requires relevant parties to facilitate access to scientific and technical knowledge and 
modern teaching methods. A child’s right to rest and leisure, to engage in play and recreational 
activities appropriate to the age of the child and to participate freely in cultural life and the arts as 
laid down in Article 31 are today intimately intertwined with the internet. Although commercial 
exploitation of children was different in 1989 when the UN-CRC was phrased the provisions of this 
article have become ever more important with the extensive collection of children’s data by digital 
media applications nowadays. Moreover protection from any form of sexual exploitation by means of 
illegal use of digital media for that purpose is explicitly relevant for children’s safety. 


The Article 2 right to non-discrimination is significant in relation to challenges associated with equal 
access to all children. 


Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 

e default privacy settings, 

e data minimisation standards, 

e the presentation and language of terms and conditions and privacy 
notices, 

e uses of geolocation technology, 

e automated and semi-automated profiling, 

e transparency of paid-for activity such as product placement and 
marketing, 

e the sharing and resale of data, 

e the strategies used to encourage extended user engagement, 

e user reporting and resolution processes and systems, 
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the ability to understand and activate a child’s right to erasure, 
rectification and restriction, 

the ability to access advice from independent, specialist advocates 
on all data rights, and 

any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
should take into account when explaining the meaning and coverage of 
these terms in the code. 


As described before the Intelligent Risk Management Model developed at the German Centre for 


Child Protection on the Internet has defined “Design and Content of Services” addressed to or used by 


children as one of three different buttresses to ensure child protection online (s. figure attached). The 


model defines also different requirements for the design and content of services for the four different 


age groups. In detail this can be described for the different areas as follows: 


default privacy settings are especially important for younger children, while up from 12 years 
children must have learned to change them on their own according to their individual needs 
based on their digital literacy and maturity 

data minimisation standards should apply to all age groups in the same way, although older 
children might feel the necessity to disclose more private data in order to manage their social 
contacts adequately this does not mean that ISS provides should be allowed to exploit these 
data for commercial purposes 

the presentation and language of terms and conditions and privacy notices needs to be 
adapted to children’s skills in reading and understanding complex instructions and 
explanations 

uses of geolocation technology should not be permitted for children under 6 years, it should 
be limited to certain applications for children aged 6 to under twelve 

automated and semi-automated profiling should not be permitted for children under 9 
years, it should be limited to certain applications for children aged up from 9 to under 12, it 
could be permitted for children up from 12 years given that adequate safety mechanisms for 
the protection of their data are in place 

transparency of paid-for activity such as product placement and marketing should be 
provided for all age groups accompanied by age-appropriate explanations 

the sharing and resale of data should not be permitted for data of children under 12 years, it 
should be limited to certain applications for data of children aged 12 and above 

the strategies used to encourage extended user engagement should not be permitted for 
children under 12 years, they should be transparent and comprehensibly explained when 
used for certain applications for children aged 12 and above 

user reporting and resolution processes and systems should be available in an easy to use 
and comprehensible manner for all age groups accompanied by age-appropriate 
explanations. Reporting procedures should be designed to enable tracing the status of a 
complaint and its status of resolution and potential redress. 

the ability to understand and activate a child’s right to erasure, rectification and restriction 
should be offered to children of all age groups addressing also the holders of parental 
responsibility especially in the case of younger children up to 12 years 

the ability to access advice from independent, specialist advocates on all data rights should 
be offered to children of all age groups being provided to children themselves and addressing 
also the holder of parental responsibility, and 
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e any other aspect of design that the commissioner considers relevant — nothing to add! 


Q5. Please provide any views or evidence you have on the following: 


Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


The main challenge of setting design standards is the development of children’s competences and 
maturity. There will be a lot of fluidity between the different age groups regardless where the 
brackets are set. From my point of view for the youngest age group processing of children’s data 
needs to be strictly limited to what is necessary for provision and usage of the service. Then with 
increasing age the limitations can be less restrictive. Still commercialisation of children’s data should 
not be allowed for children aged under 12. With children above that age any commercial use needs 
to be explained in age-appropriate language accompanied by alternative options to use the service 
with reduced or no provision of personal data. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


A positive approach could be based on the principle of safety by design, starting the development of 
services addressed to or potentially used by children with an assessment of risks to the child 
potentially occurring when using the service. Once such risks are detected the service could either be 
designed to prevent children’s usage, i. e. by age-verification, or the service could be designed in a 
way that protects children from the potential risk, i. e. by default safe settings for children of a 
certain age group. 


New Internet services and innovative devices for which there is still no concept of protection in 
particular give rise to the challenge of assessing the probability of related risks to the various age 
groups and testing the existing protection strategies and measures for suitability and applicability. 


When it comes to the development of new technologies a technology assessment process can help to 
understand the implications and potential consequences occurring from the technology for certain 
age groups. For example with such an assessment it would have been possible to predict the early 
uptake of mobile devices with intuitive touch screens by very young children. Thus there would have 
been an option to develop and implement child friendly and protective settings on these devices in 
advance. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 

See answers to Q4 


Q5D. examples of ISS design you consider to be good practice. 


www. meine-startseite.de for children aged up to 9 years 
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Q5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


Name: aaa 

ai: 

Brief summary of what you think you could offer 

Long-standing experience in technologies for child safety online; research, evaluation and assessment 
of functionalities, effectiveness and usability of so called parental control tools, i. e. filter software; 
experience in technology assessment processes on digital media and technologies; experiences in the 


development of joint approaches combining media literacy education, age-appropriate design and 
technology. 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 


None 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 
German Digital Opportunities Foundation 


A body representing the views or interests of parents? 
Please specify: 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 
Please specify: 


Thank you for responding to this call for evidence. 
We value your input. 
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